---
# Admin account: super user (declared in Kafka CR → authorization.superUsers).
# Strimzi-generated secret: kubectl -n kafka get secret kafka-admin
apiVersion: kafka.strimzi.io/v1
kind: KafkaUser
metadata:
  name: kafka-admin
  namespace: kafka
  labels:
    strimzi.io/cluster: kafka
spec:
  authentication:
    type: scram-sha-512
---
# Application account with explicit ACLs — duplicate per application.
# Strimzi-generated secret: kubectl -n kafka get secret kafka-client
apiVersion: kafka.strimzi.io/v1
kind: KafkaUser
metadata:
  name: kafka-client
  namespace: kafka
  labels:
    strimzi.io/cluster: kafka
spec:
  authentication:
    type: scram-sha-512
  authorization:
    type: simple
    acls:
      - resource:
          type: topic
          name: "*"
          patternType: literal
        operations:
          - Read
          - Write
          - Create
          - Delete
          - Describe
          - DescribeConfigs
      - resource:
          type: group
          name: "*"
          patternType: literal
        operations:
          - Read
          - Describe
      - resource:
          type: transactionalId
          name: "*"
          patternType: literal
        operations:
          - Describe
          - Write

# --- adding an application account ----------------------------------------
#
# Do not add one here. An account belongs to the application that uses it: its
# own repo says what it may read and write, and adding or removing the
# application adds or removes its access. This repo deploys a cluster and holds
# no opinion about who uses it.
#
# Create the CR from the application's own repo, in **this** namespace — Strimzi
# runs with `watchAnyNamespace=false`, so a KafkaUser anywhere else is ignored,
# silently. Copy the shape below and cut it down to what the application does:
#
#   apiVersion: kafka.strimzi.io/v1
#   kind: KafkaUser
#   metadata:
#     name: <application>
#     namespace: kafka
#     labels:
#       strimzi.io/cluster: kafka
#   spec:
#     authentication:
#       type: scram-sha-512
#     authorization:
#       type: simple
#       acls:
#         - resource: {type: topic, name: <prefix>, patternType: prefix}
#           operations: [Write, Describe]      # a producer
#         - resource: {type: group, name: <prefix>, patternType: prefix}
#           operations: [Read, Describe]       # a consumer's group
#
# A producer that can also read every topic exfiltrates every other
# application's data if it is ever compromised, and a consumer that can write
# can raise an event someone else acts on. Grant one direction, on one prefix.
#
# `kafka-client` above is the wide-open template: useful for a smoke test, and
# for nothing that runs unattended.